Medical Records and the Law

Special Disclosure Concerns 333to compete with larger integrated healthcare networks). The managementof health information is one of many critical issues to be consideredwhen a healthcare organization undergoes a change of ownershipby merger or acquisition or closes its doors and withdraws from thehealthcare market. These circumstances should be significant to anyhealth information manager or risk manager because the healthcare organization’sobligation to maintain the safety and confidentiality of itspatient records continues after a change of ownership or closure.The Privacy Rule includes in the definition of healthcare operationsthe sale, transfer, merger, or consolidation of all or a part of a covered entitywith another covered entity or with an entity that will become a coveredentity. 210 Because the rule permits covered entities to use or disclosePHI for healthcare operations without the patient’s authorization, coveredentities are able—in the course of mergers, sales, and other changesof ownership involving another covered entity—to disclose the PHIthey maintain.Thus, organizations and practitioners covered by the PrivacyRule have considerable flexibility to comply with applicable statelaw governing disposition of medical records in such transactions.The procedures for handling patient records in these transactionsare set forth in state law and regulations, which vary across the country.Healthcare records professionals also can turn to various guidelinespublished by national professional organizations. 211 In most cases,however, the better source of information is any applicable state lawthat covers the disposition of records in the event of change of ownershipor closure, 212 and any additional guidance offered by state nationalhospital and health information management associations. 213 There are21045 C.F.R. § 164.501.211See, e.g., H. Rhodes, “Practice Brief: Managing Health Information in Facility Mergersand Acquisitions,” AHIMA (1996), available at http://library.ahima.org/xpedio/groups/public/documents/ahima/pub_bok1_022080.html; P. Wanerus, “ManagingHealth Information Through a Merger,” Journal of AHIMA 65 (4): 55 (1994); AmericanHospital Association Ad Hoc Committee for Hospital Closures, Guidelinesfor Managing Hospital Closures (Chicago: American Hospital Association, 1990);M. D. Brandt, “Practice Brief: Protecting Patient Information After a Facility Closure”(AHIMA, 2003), available at http://library.ahima.org/xpedio/groups/public/documents/ahima/pub_bok1_ 022080.html.212See, e.g., Cal. Code Regs. tit. 22, § 70751(e); Ill. Admin. Code tit. 77, § 250.120(f ).213See, e.g., Colorado Health & Hospital Association, Guidelines for Consent to Care and Releaseof Health Information (Colorado Health & Hospital Association, 2004); IowaHealth Information Management Association, Iowa Guide to Medical Records Laws (IowaHealth Information Management Association, 2003).